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REMARKS 

Reexamination and reconsideration of this application is requested. Claims 1-22 have 
been canceled, and new claims 23-25 have been added. After this Response, Claims 23-25 are 
pending in this application. No new matter was added. 

The Applicant would like to note that new independent claim 23 (Method) corresponds to 
canceled independent claim 1, new independent claim 24 (Computer Readable Storage Medium) 
corresponds to canceled independent claim 11, and new independent claim 25 (System) 
corresponds to canceled independent claim 21. Additionally, new claims 23-25 all have similar 
language conforming the three independent claims to a Method, Computer Readable Storage 
Medium, and System, capable of detecting intrusions during a bootstrapping phase of an 
intrusion detection system, as will be discussed in more detail below. No new matter was added. 

Rejections under 35 U.S.C. 101 

The Examiner rejected claims 1 1-20, under 35 U.S.C. § 101. 

The Applicant has canceled claims 11-20, without prejudice or disclaimer, so the 
rejection of these claims under 35 U.S.C. § 101 is rendered moot. Please note that the new 
independent claim 24 is directed to a Computer Readable Storage Medium for storing computer 
instructions for detecting intrusions during a bootstrapping phase of an intrusion detection 
system. Applicant believes that the storage medium claim language recited for new claim 24 is 
statutory, and requests that the Examiner withdraw the rejection under 35 U.S.C. § 101. 

Additionally, please note that Applicant has included in new claim 24 claim language 
from the canceled claims, and language supported by the specification as originally filed. No 
new matter was added. 
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Rejections under 35 U.S.C. 102 and 103 

The Examiner rejected claims 1-10 under 35 U.S.C. § 102(e) as being anticipated by 
Gosh (U.S. Patent No. 7,181,768), and claims 11-22 under 35 U.S.C. § 103(a) as being 
unpatentable over Gosh in view of Munson (U.S. Patent No. 6,681,331). The Examiner relies 
primarily on the reference by Gosh and refers to the reference by Munson for the combination 
with the teachings of Gosh to suggest the computer system and computer readable storage 
medium as recited for claims 1 1-22. 

The Applicant has canceled claims 1-22, without prejudice or disclaimer. The new 
independent claims 23-25 include claim language from the canceled claims, and language 
supported by the specification as originally filed. In particular, for example, please refer to the 
specification on page 5, line 20, to page 6, line 9, and on page 14, lines 5-15. No new matter was 
added. 

Gosh teaches generating logs while an application "normally" operates on a computer 
system. These generated logs are used as a profile of normal operation of the application while 
operating in the computer system. See, for example, column 1, lines 27-30, and line 48, and line 
58, and column 3, lines 46-47, and lines 54-62. Gosh also indicates, on column 4, lines 10-24, 
that state machine models of application behavior could be derived by hand and then used to 
monitor violations of specified behavior. 

Gosh does not address the problem of detecting intrusions during a bootstrapping phase 
(during the initial learning stage) of an intrusion detection system. 

Additionally, contrary to the assertions in the Office Action paragraphs 11 and 12 with 
reference to Gosh column 1, lines 24-64, there are no expressed teachings or suggestions in Gosh 
that the behavior profile is stored as encrypted and/or digitally signed, and ready to be read by 
the monitor in the intrusion detection system to monitor the behavior of an application during a 
bootstrap phase. 

It is particularly important, during a boot strapping phase of an intrusion detection system 
(IDS) to securely bootstrap the IDS - during the initial learning stage of the IDS. See the 
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specification, on page 5, line 22, and on page 6, lines 5-9. This is not taught or suggested by 
Gosh. 

Therefore, in view of the foregoing remarks, Applicant believes that the rejection of 
Claims 1-22 under 35 U.S.C. § 102(e) and § 103(a) have been overcome, and that new 
independent claims 23-25 are allowable in view of the cited art. Accordingly, the Applicant 
requests that the Examiner withdraw the rejection and allow Claims 23-25. 

Conclusion 

The foregoing is submitted as a full and complete response to the Official Action mailed 
March 25, 2008, and it is suggested that Claims 23-25 are in condition for allowance. 
Reconsideration of the rejections is requested. Allowance of Claims 23-25 is earnestly solicited. 

This amendment is being submitted to expedite the patent application process in a 
manner consistent with PTO's Patent Business Goals (PBG), 65 Fed. Reg. 54603 (September 8, 
2000). 

Applicant is not conceding in this application that the cancelled claims are not patentable 
over any prior art, as the present claim amendments and cancellations are only for facilitating 
expeditious prosecution of allowable subject matter. Applicant respectfully reserves the right to 
pursue the cancelled and other claims in one or more continuations and/or divisional patent 
applications. 

No amendment made was related to the statutory requirements of patentability unless 
expressly stated herein. No amendment made was for the purpose of narrowing the scope of any 
claim, unless Applicant has argued herein that such amendment was made to distinguish over a 
particular reference or combination of references. 

Applicant acknowledges the continuing duty of candor and good faith to disclose 
information known to be material to the examination of this application. In accordance with 37 
CFR § 1.56, all such information is dutifully made of record. The foreseeable equivalents of any 
territory surrendered by amendment are limited to the territory taught by the information of 
record. No other territory afforded by the doctrine of equivalents is knowingly surrendered and 
everything else is unforeseeable at the time of this Response by the Applicant and attorneys. 
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If the Examiner believes that there are any informalities that can be corrected by 
Examiner's amendment, or that in any way it would help expedite the prosecution of the 
patent application, a telephone call to the undersigned at (561) 989-9811 is respectfully 
solicited. 

The Commissioner is hereby authorized to charge any fees that may be required or credit 
any overpayment to Deposit Account 50-1556 

In view of the preceding discussion, it is submitted that the claims are in condition for 
allowance. Reconsideration and re-examination are requested. 

Respectfully submitted, 

Date: June 20, 2008 By: /Jose Gutman/ 

Jose Gutman 
Reg. No. 35,171 

FLEIT, KAIN, GIBBONS, GUTMAN 
BONGINI & BIANCO P.L. 
551 N.W. 77th Street, Suite 1 1 1 
Boca Raton, FL 33487 
Tel (561) 989-9811 
Fax (561) 989-9812 
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